curl: curl: never-ending loop via server response omission

A flaw was found in curl. When communicating with a malicious server using protocols such as FTP, IMAP, POP3, or SMTP, the server can trigger an infinite loop by continuously transmitting data while omitting the final control response line. This behavior bypasses configured transfer timeouts,...

curl: curl: HSTS cache import drops longer-lived child

A flaw was found in curl. When importing HTTP Strict Transport Security HSTS cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade...

curl: curl: server-set cookie aborts cookie jar load

A flaw was found in curl. A remote malicious server can trigger a denial of service DoS in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: curl: curl-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-devel-8.23.0-0.1.hum1 aarch64, s390x, x8664 libcurl-minimal-8.23.0-0.1.hum1 aarch64, s390x,...

curl: curl: password leak in CURLINFO_EFFECTIVE_URL

A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file such as a .netrc file, requesting the effective URL metadata can cause the returned destination...

curl: curl: server-set cookie erases cookie jar

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

A flaw was found in curl. When performing multi-threaded LDAPS Lightweight Directory Access Protocol Secure transfers, changes to Transport Layer Security TLS options in one thread could inadvertently apply globally, affecting other concurrent transfers. This could lead to unintended security...

curl: curl: Negotiate credentials sent to redirected origin

A flaw was found in curl. When curl is configured to follow HTTP redirects while performing Negotiate authentication using system-provided Kerberos credentials, it may forward authentication details to an unrelated destination. A malicious server can exploit this flaw by redirecting the client to...

curl: curl: TFTP direction confusion

A flaw was found in curl. When handling Trivial File Transfer Protocol TFTP transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive...

curl: curl: info leak uploading over WebSockets with GnuTLS

A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash...

curl: curl: cross-origin reuse of a Negotiate connection

A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...

curl: curl: local interface connection reuse mixup

A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause...

curl: curl: wolfSSL public-key pinning bypass

A flaw was found in curl. This vulnerability allows a malicious server to bypass public key pinning when curl is built with the wolfSSL backend. By presenting a specially crafted certificate with a manipulated validity length field, the attacker can trick curl into improperly re-parsing the...

curl: curl: HTTP/2 upload Use-After-Free

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

curl: curl: FTP connection reuse inherits client-certificate

A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...

curl: curl: Authorization: Negotiate sent to foreign origin

A flaw was found in curl. When processing an HTTP redirect to an address containing user credentials, curl improperly retains and retransmits authentication state. A malicious server can exploit this behavior by redirecting curl to an untrusted destination, forcing the client to transmit sensitiv...

curl: curl: curl_mime_free stack overflow by recursion

A flaw was found in curl. An attacker could supply deeply nested Multipurpose Internet Mail Extensions MIME structures to an application utilizing the libcurl library. During memory cleanup in the curlmimefree function, excessive recursive calls exhaust available stack memory, leading to an...

curl: IMAP APPEND plus CRLF conversion command injection

A flaw was found in curl. When curl is configured to perform carriage return and line feed CRLF conversion during an Internet Message Access Protocol IMAP append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the...

curl: curl: FTP wildcard write callback mixup

A flaw was found in curl. A remote malicious server can cause a Denial of Service DoS or memory corruption in applications that enable File Transfer Protocol FTP wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the...

curl: curl: Hsts Response Erases Persisted Entries

A flaw was found in curl. When persistent HTTP Strict Transport Security HSTS caching is enabled, a remote HTTPS server can return an out-of-range expiration value that fails time serialization during cache saving. Because curl truncates the cache file prior to writing the update, this...